🚨 CVE-2023-29538
Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
bugzilla.mozilla.org
1685403 - (CVE-2023-29538) onLoadRequest contains translated jar:file:/// URI instead of moz-extension:///
RESOLVED (kershaw) in Core - Networking. Last updated 2025-01-15.
🚨 CVE-2023-29539
When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
🎖@cveNotify
When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
🎖@cveNotify
bugzilla.mozilla.org
1784348 - (CVE-2023-29539) Content-Disposition filename truncation leads to Reflected File Download
RESOLVED (smayya) in Core - Networking: HTTP. Last updated 2024-05-30.
🚨 CVE-2023-29540
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
bugzilla.mozilla.org
1790542 - (CVE-2023-29540) allow-top-navigation-to-custom-protocols iframe sandbox bypass using sourceMappingUrls
VERIFIED (hmanilla) in DevTools - Console. Last updated 2025-07-07.
🚨 CVE-2023-29541
Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
🎖@cveNotify
Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
🎖@cveNotify
bugzilla.mozilla.org
1810191 - (CVE-2023-29541) .desktop file extension on Linux should be rewritten to .desktop.download to avoid users running local…
VERIFIED (gijskruitbosch+bugs) in Firefox - File Handling. Last updated 2024-05-30.
🚨 CVE-2023-29543
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
bugzilla.mozilla.org
1816158 - (CVE-2023-29543) js::gc::detail::CellHasStoreBuffer (cell=0xe5e5e5e5e5e5e5e5)
RESOLVED (jcoppeard) in Core - JavaScript Engine. Last updated 2024-11-24.
🚨 CVE-2023-29544
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
bugzilla.mozilla.org
1818781 - (CVE-2023-29544) Assertion failure: !hasDelayedMarking(), at js/src/gc/GC.cpp:1370
RESOLVED (jcoppeard) in Core - JavaScript: GC. Last updated 2024-11-24.
🚨 CVE-2023-29548
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
🎖@cveNotify
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
🎖@cveNotify
bugzilla.mozilla.org
1822754 - (CVE-2023-29548) Wrong lowering of UDiv MIR in ARM64 Ion compiler
VERIFIED (nicolas.b.pierron) in Core - JavaScript Engine: JIT. Last updated 2024-06-02.
👏1
🚨 CVE-2023-29549
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
bugzilla.mozilla.org
1823042 - (CVE-2023-29549) Assertion failure: cx->realm() == fun->realm(), at jit/VMFunctions.cpp:818
RESOLVED (jdemooij) in Core - JavaScript Engine. Last updated 2024-06-02.
🔥1
🚨 CVE-2023-29550
Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
🎖@cveNotify
Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
🎖@cveNotify
🚨 CVE-2023-29551
Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
🎖@cveNotify
🚨 CVE-2023-25747
A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 110.1.0.
🎖@cveNotify
A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 110.1.0.
🎖@cveNotify
bugzilla.mozilla.org
1815801 - (CVE-2023-25747) Crash in [@ soundtouch::TDStretch::seekBestOverlapPositionFull]
RESOLVED (padenot) in Core - Audio/Video: Playback. Last updated 2023-10-17.
🚨 CVE-2023-29534
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks.
*This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.
🎖@cveNotify
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks.
*This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.
🎖@cveNotify
bugzilla.mozilla.org
1816007 - Obscuring Full-Screen Toast in Android Through Google Assistant URI
RESOLVED (petru) in Firefox for Android - Browser Engine. Last updated 2024-05-30.
🚨 CVE-2023-5758
When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119.
🎖@cveNotify
When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119.
🎖@cveNotify
bugzilla.mozilla.org
1850019 - (CVE-2023-5758) XSS on the domain reader in the firefox browser application for IOS
VERIFIED (nobody) in Firefox for iOS - General. Last updated 2024-09-16.
🚨 CVE-2023-49060
An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. This vulnerability affects Firefox for iOS < 120.
🎖@cveNotify
An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. This vulnerability affects Firefox for iOS < 120.
🎖@cveNotify
bugzilla.mozilla.org
1861405 - (CVE-2023-49060) Privilege escalation in Firefox for iOS through <a [referrerpolicy]> in ReaderMode
VERIFIED (lmarceau) in Firefox for iOS - General. Last updated 2024-08-14.
🚨 CVE-2023-49061
An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS < 120.
🎖@cveNotify
An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS < 120.
🎖@cveNotify
bugzilla.mozilla.org
1861420 - (CVE-2023-49061) HTML injection in %READER-BYLINE% of ReaderMode of Firefox for iOS
VERIFIED (lmarceau) in Firefox for iOS - Reader View. Last updated 2024-09-16.
🚨 CVE-2024-0953
When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content. This vulnerability affects Firefox for iOS < 129.
🎖@cveNotify
When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content. This vulnerability affects Firefox for iOS < 129.
🎖@cveNotify
bugzilla.mozilla.org
1837916 - (CVE-2024-0953) Firefox for iOS QR Code Scanner does not show the URL for user confirmation before opening it
RESOLVED (nobody) in Firefox for iOS - General. Last updated 2025-01-14.
🚨 CVE-2024-38312
When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This vulnerability affects Firefox for iOS < 127.
🎖@cveNotify
When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This vulnerability affects Firefox for iOS < 127.
🎖@cveNotify
bugzilla.mozilla.org
1878578 - (CVE-2024-38312) Firefox on iOS - Private Browsing Security Bug
RESOLVED (nobody) in Firefox for iOS - General. Last updated 2024-12-02.
🚨 CVE-2024-38313
In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects Firefox for iOS < 127.
🎖@cveNotify
In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects Firefox for iOS < 127.
🎖@cveNotify
bugzilla.mozilla.org
1878489 - (CVE-2024-38313) URL spoofing by abusing auto hide URL bar feature (FxiOS)
VERIFIED (nobody) in Firefox for iOS - Browser. Last updated 2024-12-02.
🚨 CVE-2024-7523
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions.
*This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129.
🎖@cveNotify
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions.
*This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129.
🎖@cveNotify
bugzilla.mozilla.org
1908344 - (CVE-2024-7523) Tapjacking Permission (Camera, Location, Microphone, etc.) Using Select Option on Android
RESOLVED (amejiamarmol) in Firefox for Android - Browser Engine. Last updated 2026-08-13.
🚨 CVE-2024-43111
Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129.
🎖@cveNotify
Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129.
🎖@cveNotify
bugzilla.mozilla.org
1874907 - (CVE-2024-43111) iOS Firefox allows to run javascript with download
RESOLVED (nobody) in Firefox for iOS - General. Last updated 2025-04-21.
🚨 CVE-2024-43112
Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129.
🎖@cveNotify
Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129.
🎖@cveNotify
bugzilla.mozilla.org
1874910 - (CVE-2024-43112) iOS Firefox Download UXSS
VERIFIED (nobody) in Firefox for iOS - General. Last updated 2025-04-21.